kenryu42/cc-safety-net
Pre-execution guard that blocks destructive Git and filesystem commands and access to secrets such as SSH keys and .env files before a tool call runs.
Install
via npm
Resolves a published tarball rather than cloning the repository, and installs without any extra setup. Swap `web` for your profile name if you run another one.
via GitHub · npm package
Installing from GitHub runs the project's build script, which pnpm blocks until you allowlist it — run the command once and pnpm prints the exact key to add under `allowBuilds` in ~/.dsh/profiles/web/pnpm-workspace.yaml.
The desktop app keeps its own profile, desktop, and only the dsh command it ships may change it — the npm-installed dsh refuses that profile. Install the command from the app menu (Manage dsh Command…), open Desktop once, quit it fully, run the line below, then reopen Desktop.
via npm
Resolves a published tarball rather than cloning the repository.
via GitHub · npm package
Installing from GitHub runs the project's build script, which pnpm blocks until you allowlist it — run the command once and pnpm prints the exact key to add under `allowBuilds` in ~/.dsh/profiles/desktop/pnpm-workspace.yaml.
Our install check ran in a web profile on npm's dsh, not in the desktop app.
What happened when we ran it
Installed cleanly when we ran it
Every command here is run in a throwaway container against a clean profile, and the result is whatever the harness recorded — not a guess from the source. Last run 6d agoon DeepSeek Harness 0.2.1-rc.5.
Show it in your README
For maintainers: the badge serves this listing's latest sandbox verdict, so a re-run updates it on its own — and it links readers to the full result here.
Due diligence
Security
No build script was blocked in our run.
Source: our sandbox install on DeepSeek Harness 0.2.1-rc.5, 6d ago.
package.json declares no preinstall, install or postinstall script.
Source: package.json on GitHub, read at our last sync. prepare is not recorded; it runs only on a GitHub install, and shows up under build scripts when pnpm blocks it.
shell commands (bash, exec, spawn …)
Source: a keyword match on the README — a hint about what the plugin touches, not an analysis of its code.
Not an audit. These are the record of one install and two text scans; nobody has read this plugin's code on your behalf. Plugins run with your agent's permissions.
What it is — Parses each tool call before it runs and stops destructive Git or filesystem actions and reads of SSH keys or .env files.
Who it is for — A DeepSeek Harness agent with git and shell on a laptop checkout that still holds .env files and keys, where git reset --hard would wipe real commits. Skip it when the agent only runs in a throwaway directory or disposable VM that holds neither secrets nor history you would miss.
Watch out — Our run installed it on a fresh profile and the harness registered it. It does not sandbox: no process jail, no filesystem permission changes, no egress watch. A broken config file blocks nothing.
The verdict — On a machine whose git history I cannot rebuild, this earns a plugin slot. The install does not buy a wider auto-approve or a workspace full of keys.
Generated by grok-4.6, and a starting point rather than a verdict. Where it says a plugin installs or does not, that is from a real run in a clean profile — everything else is read off the repository. Trust the source over this.
cc-safety-net is a DeepSeek Harness plugin that checks commands and file-access requests before an agent tool call runs, blocking selected destructive operations and access to sensitive files. It parses what a command would do rather than matching only its surface spelling, so wrapping a command or reordering flags does not hide it. The protection covers shell commands such as git reset --hard, git push --force, and rm -rf on dangerous targets, including commands nested in bash -c or python -c. It also covers the agent’s file tools for SSH keys, .env files, ~/.aws, and coding-CLI credentials.
DeepSeek Harness loads the plugin at the pre-execution boundary. The plugin reads the proposed command or file path and decides whether the call may proceed; blocked calls are not run, and the agent is told why. Its GUI, started with npx cc-safety-net gui, provides Standard, Strict, and Paranoid presets and lets operators enable or disable rules.
This is intended for agents with terminal and filesystem access where destructive commands or secret reads need an additional policy check. The terminal surface is a material risk because the plugin evaluates commands issued with the agent’s permissions. cc-safety-net is not a sandbox: it does not contain processes, set filesystem permissions, or watch network egress. A broken configuration file never blocks anything, so it should not be treated as a complete isolation boundary.
DeepSeek Harness checks a proposed tool call before execution when cc-safety-net is installed. For terminal requests, the plugin parses the command’s effective operation, including commands nested inside bash -c and python -c. Reordering flags or wrapping a command does not conceal the operation. Safe calls such as git status can proceed; blocked calls do not run, and the agent receives the reason.
The documented destructive-command examples include git reset --hard, git push --force, and rm -rf when used on dangerous targets. Secret protection covers SSH keys, .env files, ~/.aws, and coding-CLI credentials. The same protection applies to the agent’s file tools, not only the shell.
Run npx cc-safety-net gui to open the configuration GUI. It provides the Standard, Strict, and Paranoid presets and allows individual rules to be turned on or off. The README does not specify configuration key names or a configuration-file path.
A broken configuration file never blocks anything. This behaviour means a malformed or unavailable policy configuration does not provide a fail-closed guarantee.
DeepSeek Harness is listed among the supported coding CLIs. The README also lists support for Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Devin CLI, Factory Droid, Gemini CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
DeepSeek Harness gives the plugin a pre-execution decision point, but cc-safety-net is not a sandbox. It does not contain processes, change filesystem permissions, or monitor network egress. The plugin therefore supplements, rather than replaces, isolation controls. The README states support for Windows, macOS, and Linux and does not state a version requirement.
Written from the project's own documentation and kept in sync with it. Where the two disagree, the source is authoritative — read the README on GitHub
Same category
toby-bridges
Runs local security audits of AI API relays and LLM proxies from DeepSeek Harness, producing Markdown reports for prompt injection, model substitution signals, tool-call rewriting, error leakage, stream integrity, and profile-gated Web3 risks.
DeepSeek Harness 0.2.1-rc.5 refuses the latest release
SeaOf0
Authorized-security DSH collection: nine work modes (redteam coordinator, pentest, code audit, binary analysis, attack-defense, AV evasion, incident response, cloud security, CTF solving) and fifteen runtime plugins, managed from a settings page with one-click deploy, install, update and uninstall.
Installed cleanly when we ran it
howmp
Authorized pentest mode for DeepSeek Harness — exploration chain, assets and findings with a Web view.
Installed cleanly when we ran it
PerryLink
Second-model auto-review on the approval answerer chain: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default.
Installed cleanly when we ran it
ADWMC
Security-analysis plugin for DeepSeek Harness: 33 tools spanning six security domains, evidence/reporting and toolbox, plus the case lifecycle, routing and tool ledger; a session-bound case workflow with an evidence chain, E-id validation and reproducible findings; 362 on-demand references; three hot-swappable persona profiles; and a four-tab workbench (armor / case / intercept / about) with case-state recovery after context compaction.
No one-line install — this plugin lives inside a larger repository and publishes no npm package.
PerryLink
Claude Code-style declarative permission rules: ordered allow/deny/ask YAML rules matching tool names, arguments, workspace paths, and agent identity on the tools/pre-execute waterfall, with full session-log audit, dry-run mode, and hot reload.
Installed cleanly when we ran it
